Loading story…
Large-scale SMS phishing campaigns in Iran impersonated government bodies and other trusted services to lure victims to phishing sites, where they were prompted to install malicious Android applications and submit payment card details. The malware blended credential theft with mobile backdoor functions, including SMS theft, 2FA interception, contact harvesting, app hiding, and the ability to spread additional phishing messages through a botnet using Firebase Cloud Messaging.
The activity reportedly hit tens of thousands of victims and stole billions of Iranian rials, with some individuals losing the equivalent of $1,000 to $2,000. Researchers found that the operation relied on rapidly rotating phishing domains, hardcoded control panels, and in some cases leaked or poorly secured operator panels that exposed stolen victim data to third parties. The campaigns were also tied to a broader botnet-as-a-service ecosystem promoted in Iranian Telegram channels, where phishing kits and mobile campaign panels were sold to low-skill operators, helping the fraud scale and persist.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The analysis found that phishing pages, Android kits, and control panels were being sold through Iranian Telegram channels, indicating a botnet-as-a-service ecosystem that enabled low-skill operators to run the campaigns at scale.
Poor operational security left attacker control panels and directories accessible, exposing stolen SMS, contacts, bot lists, and campaign files to third parties. One panel reportedly hosted more than 10 campaigns, and leaked data showed more than 1,000 victims installed one app in less than 10 days.
The malicious Android apps used in the campaigns functioned as backdoors that uploaded SMS messages, intercepted 2FA codes, stole contacts, hid their icons, and sent additional phishing SMS messages from infected phones. Operators controlled infected devices through Firebase Cloud Messaging and panel infrastructure.
Multiple SMS phishing campaigns in Iran impersonated government services and other trusted brands, directing victims to fake sites that collected personal and payment-card data and pushed malicious Android APKs. The campaigns reportedly affected tens of thousands of victims over a period of months and stole billions of Iranian rials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 68 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Researchers reported multiple Android remote access trojans using **Telegram’s Bot API** for command-and-control and data exfiltration, with **TeleRAT**, **IRRAT**, and the later **HeroRat** targeting users primarily in Iran. The malware hid its activity within legitimate Telegram communications while giving operators broad surveillance and device-control capabilities, including theft of **SMS**, contacts, account data, files, photos, location, and clipboard contents, as well as support for calls, texting, audio recording, picture capture, screen recording, and device settings manipulation. Palo Alto Networks identified **2,293 victims**, about **82%** tied to Iranian phone numbers, and said the activity likely involved several actors rather than a single group. The malware was distributed through **third-party Android app stores**, Telegram channels, social media, and messaging apps using lures such as fake VPN tools, profile-viewer apps, Telegram Finder, free bitcoins, free internet, and social-media follower offers. ESET said **HeroRat** emerged as a distinct family after source code leaked on Telegram channels, leading to many variants and a commercialized version marketed under that name; once installed, it displayed a fake uninstall message while remaining active. Researchers also found repeated operational security failures around the ecosystem, including exposed bot histories, hardcoded API keys, accessible webhooks, and public advertising of malware code and bot-control libraries, while noting the malware was **not observed on Google Play**.
Aug 14, 2026
Criminals are increasingly abusing **SMS as a fraud channel**, using both network-level and device-level techniques to bypass traditional defenses and steal credentials, banking data, and one-time passcodes. One reported method uses **SMS blasters**—portable false base stations or cell-site simulators—to inject phishing texts directly into nearby phones without traversing carrier networks, allowing messages spoofing government agencies or banks to evade carrier spam filtering. Another technique targets Android devices through the **LSPosed** framework and the **Digital Lutera** module, enabling attackers to capture SMS verification tokens, impersonate phone numbers, insert fraudulent SMS records, and support real-time payment app account takeover and transaction approval. The fraud ecosystem also includes large-scale **smishing campaigns** built around fake parcel delivery notifications, with Group-IB reporting sustained growth across the Middle East and Africa and postal brands most frequently abused. Those campaigns use urgent shipment-tracking lures to drive victims to counterfeit courier sites that harvest personal data, card details, banking credentials, and OTPs. Together, the reporting shows that mobile fraud is expanding through both social engineering and deeper technical abuse of telecom and mobile operating system trust models, exposing weaknesses in SMS-based authentication and message trust assumptions.
Jun 29, 2026